Keep OT and CIP-style evidence inside a sovereign operational workspace.